3

This question is with regards to mobile apps and apps stores.

Is it possible to program a mobile app that looks like a legitimate app, say for a bank, with the aim that people will download and use it, and key in their user id and password.

This 'fake' mobile app will then capture their password and send this info back to their own servers.

Is this possible ?

3

Well, the app is certainly possible. If the app was created for good by a bank, it can be recreated for evil. Especially if the evil app doesn't actually need to handle banking transactions. It could just scoop the credentials and crash.

I think the other half of this question is "Are people dumb enough to fall for this?" Absolutely. Stupid is a renewable resource. Not everyone will fall for this (app distributors wouldn't ever publish it) but some will have that killer combination of ignorance and hubris and get their bank credentials stolen.

2

To expand on Ohnana 's answer, yes this is possible. If you were to create an application that essentially looked exactly the same as the bank's login screen, it could scrape the credentials and crash like they suggest. However, when you do that, and people start reviewing your app, it will be heavily rated on the bad (1-2 stars) side, which decreases exposure for your app.

I by no means encourage this type of app, but if you were to create an app like this, I'd think that the better way would be to: Display login screen (and scrape entered details, maybe upon successful login [which you could test for]), then after scraping, pass the credentials to the server to actually sign in... It's an interesting thought, and trust me... I've thought to do this with some sites I have because they just redirect... but I'm sure it's not exactly a "nice" thing to do... let alone, illegal.

  • Good points. Although I had in mind a distribution method that did not involve reviews, like banner ads. (Your phone's slow and hacked! Download now!) – Ohnana Dec 22 '14 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.